Device for recording data, record carrier and method for recording data

ABSTRACT

A device and method for recording data on a track ( 5 ) of a record carrier ( 1 ) are described. The record carrier ( 1 ) for use in such a device and method is also described. The record carrier ( 1 ) comprises two identical keylockers (7, 8). The keylockers contain encrypted information about the usage rights of the data on the record carrier ( 1 ). When these usage rights need to be updated, the keylockers are invalidated and new keylockers are written. Invalidating the old keylockers on a write once record carrier ( 1 ) can be done by a laser pulse with a high power level. However, data directly adjacent to the information that is invalidated becomes inaccessible. Therefore, only part of the keylockers ( 7, 8 ) is invalidated. This part needs to be an identical part of both keylockers ( 7, 8 ) so that the information of the whole keylocker cannot be restored. The distance between the neighboring data and the part of the keylocker that is invalidated is increased by arranging the information of the first keylocker ( 7 ) differently from the information of the second keylocker ( 8 ) in that the information that is to be invalidated of at least one keylocker is positioned closer to the other keylocker than in a situation in which the information of the keylockers ( 7, 8 ) is arranged identically.

The invention relates to a device for recording data on a track of arecord carrier, which record carrier comprises a first keylocker whichholds information about the data and a second keylocker which holds thesame information, which two keylockers are positioned adjacent to eachother on the track, the device comprising invalidating means forinvalidating the keylockers.

The invention further relates to a record carrier having a track forrecording data, the record carrier comprising a first keylocker whichholds information about the data and a second keylocker which holds thesame information, the two keylockers being positioned adjacent to eachother on the track.

The invention also relates to a method of recording data on a track of arecord carrier, which record carrier comprises a first keylocker whichholds information about the data and a second keylocker which holds thesame information, the two keylockers being positioned adjacent to eachother on the track, the method comprising a step of invalidating thekeylockers.

As copying of data in the form of copyrighted material from one recordcarrier to an other becomes more and more easy, the need for properprotection of that data becomes greater. An example of a scheme toprotect data uses a so-called keylocker. In a keylocker all secrets, forexample usage rights, keys, counters, a unique identification of thedisc or any information are stored in the keylocker in a tamper-freeway. Usage rights may be, for example, the rights to play or copy thedata on the record carrier. A keylocker is encrypted with a so-calledkeylocker key. It is common to have two or more identical copies of thekeylocker on the record carrier. If one keylocker is damaged, the otherkeylocker can be used. The keylockers are commonly placed adjacent toeach other.

An example of data that can be protected is music. The keylocker maycontain the right to copy the music once. After a copy has been made,the keylocker is updated indicating that no more copy can be made. Ifthe record carrier is a write once record carrier, or if the data iswritten on the record carrier in a similar way as with a write oncerecord carrier, the updating of the keylocker is done by writing newkeylockers and invalidating the old ones. On a write once recordcarrier, invalidating can be done by damaging the keylockers with alaser pulse having a sufficiently high power level. A problem with thisinvalidation is that also the data directly adjacent to the keylockerswill be damaged or will be inaccessible. The directly adjacent data canbe damaged when the data is written interleaved on the record carrier.Interleaved writing means that the data is not written continuously butin blocks, which blocks are written with a spacing between them. Thatspacing may be, for example, two or three blocks of other data. Whendata is invalidated, units of data are invalidated that do not coincidewith the interleave blocks. Therefore also data adjacent to thekeylocker is invalidated. The data directly adjacent to the keylockermay also become inaccessible when the keylocker is invalidated becauseof the following reason. When a device such as an optical recorder wantsto access certain target data on the record carrier, it does not jumpdirectly to the target address of that data, but to a previous addressbefore the target address. This is done because the optical recorderthen has time to settle before the target data is read. If the data onthe previous address is invalidated, however, the target data isinaccessible.

It is an object of the invention to provide a device and method forrecording data which is able to invalidate the keylockers without makingthe neighboring data inaccessible.

It is also an object of the invention to provide a record carrier whichcontains keylockers that can be invalidated without making theneighboring data inaccessible.

For this purpose, the device as described in the opening paragraph ischaracterized in that the invalidating means are able to invalidate thekeylockers by invalidating an identical part of the information of thefirst keylocker and of the second keylocker, the information of thefirst keylocker being arranged differently from the information of thesecond keylocker in that the information that is to be invalidated of atleast one keylocker is positioned closer to the other keylocker than ina situation in which the information of the keylockers is arrangedidentically. The record carrier described in the opening paragraph ischaracterized in that the keylockers can be invalidated by invalidatingan identical part of the information of the first keylocker and of thesecond keylocker, the information of the first keylocker being arrangeddifferently from the information of the second keylocker in that theinformation that is to be invalidated of at least one keylocker ispositioned closer to the other keylocker than in a situation in whichthe information of the keylockers is arranged identically. The methoddescribed in the opening paragraph is characterized in that the step ofinvalidating the keylockers invalidates the keylockers by invalidatingan identical part of the information of the first keylocker and of thesecond keylocker, the information of the first keylocker being arrangeddifferently from the information of the second keylocker in that theinformation that is to be invalidated of at least one keylocker ispositioned closer to the other keylocker than in a situation in whichthe information of the keylockers is arranged identically.

It is sufficient to invalidate only a part of the keylocker in order todisable the use of the keylocker. If the same part of all the keylockersis disabled, it is not possible to retrieve the whole keylocker.However, disabling of, for example, the first part of both keylockerswill also disable the data preceding the first keylocker. Disabling thefirst part of the keylockers is preferable, because in practice thespace reserved for the keylocker could be greater than the keylockerneeds, resulting in the last part of the space reserved for thekeylocker being unused. Disabling the last part would have the resultthat the information of the whole keylocker is still retrievable. If thefirst part of the first keylocker is arranged closer to the other,adjacent keylocker, then that first part is further away from thepreceding data and the preceding data will not be damaged. This ensuresa better integrity of the preceding data after invalidation. In anembodiment, the keylocker contains usage rights of the data. Theserights may be, for example, the right to copy the data once.

In an embodiment of the recording device, the information that is to bedeleted of the first keylocker is directly adjacent to the informationthat is to be deleted of the second keylocker. This has the advantagethat the information that is to be deleted is as far as possible awayfrom the data directly neighboring the keylockers, thereby minimizingthe risk of making the neighboring data inaccessible.

In another embodiment, the information contained in the keylockers isdivided into sectors. The part of the information that is to beinvalidated preferably comprises the last sectors of the first keylockerand the first sectors of the second keylocker.

In a further embodiment, the record carrier comprises more than twokeylockers which are adjacent to each other, and the first keylocker andthe second keylocker are the two outermost keylockers. Here again thepart of the information that is invalidated is further away from theneighboring data. The arrangement of the information of the keylockersbetween the first and second keylocker is not important in thisconnection.

These and other aspects of the invention will be apparent from andelucidated further with reference to the embodiments described by way ofexample in the following description and with reference to theaccompanying drawings, in which

FIG. 1 shows a recording device,

FIG. 2 shows an example of a keylocker area structure,

FIG. 3 a shows an example of two identical keylockers,

FIG. 3 b shows another example of two identical keylockers,

FIG. 4 diagrammatically shows the process of writing new keylockers andinvalidating the old keylockers,

FIG. 5 shows an example of a corrupted sector which is directly adjacentto the invalidated sectors.

FIG. 1 shows an embodiment of a recording system having a record carrier1, rotating means 4, and a transducer 2. The transducer 2 may be, forexample, an optical pickup unit. An optical pickup unit emits aradiation beam 3 which is reflected by the record carrier 1. The recordcarrier 1 in this example contains the data on a track 5 (see FIG. 2),which track 5 may consists of pits that will or will not reflect theradiation beam 3. Physical elements other than pits which result inreflecting or not reflecting the radiation beam 3 may also be used forregistering data on the track 5. The reflected radiation beam 3 isconverted by the transducer into a signal that is further processed byfurther processing means in the recording device. The further processingmeans converts the signal from the transducer 2 into a reproductionsignal which may be an audio signal, for example. The recording devicealso comprises invalidation means 20. The invalidation means 20 areconnected to the transducer 2 for invalidating the keylockers. In thisembodiment, the record system is also capable of playing back a recordcarrier 1. In an alternative embodiment, the recording system is capableof recording data on a record carrier 1, but not capable of playing backa record carrier 1.

In FIG. 2, a track 5 which holds a so-called keylocker area 11 isdepicted. In this case the keylocker area 11 resides in the program areaof the track. The program area is the area where the user data 6 isstored on the track 5. The track 5 in this example also has anunrecorded area 10. The program area thus comprises the user data 6, thekeylocker area 11, and the unrecorded area 10. The keylocker area 11consists of a first keylocker 7, a second keylocker 8, and a furtherinformation area 9. The further information area 9 comprises anadaptation layer parameter space ALP, and may comprise an enabling keyblock EKB and a black list BL. The ALP structure comprises pointers tothe keylockers. The EKB is a data structure that is used to communicatea secret cryptographic key to a set of authorized devices or PCapplications. The BL is a list containing identifiers of devices orother entities that have been declared invalid.

FIGS. 3 a and 3 b show two examples of the keylockers 7 and 8 on arecord carrier 1 according to the invention. In FIG. 3 a, the keylockers7 and 8 consist of eight sectors each. Each sector in this examplecontains two kilobytes of information. In FIG. 3 b, the keylockers 7 and8 consist of 168 sectors each. The information contained in thekeylockers 7 and 8 is usually encrypted. The encrypted information isstored in the keylockers starting from sector 1 to the last sector. Ofcourse not all sectors need to contain encrypted information. Therefore,when the keylockers need to be invalidated by invalidation of anidentical part of the encrypted information of both keylockers, thesafest sectors to invalidate are the sectors with the lowest numbers. Inthis example sectors 1 and 2 are invalidated. The encrypted informationof the keylockers shown in FIGS. 3 a and 3 b are arranged so thatsectors 1 and 2 of the first keylocker 7 are directly adjacent to thesectors 1 and 2 of the second keylocker 8. In this way there are sixsectors between the invalidated sectors and the neighboring data, whichis the maximum number of sectors if two sectors of the keylockers needto be invalidated. In FIG. 3 b there are even more sectors between theinvalidated sectors and the neighboring data. This ensures the integrityof the neighboring data after invalidation of the keylockers. Of courseother sectors and/or an other number of sectors may also be invalidated.The sectors of the first keylocker 7 and the second keylocker 8 thatneed to be invalidated do not have to be adjacent, but this does havethe advantage that there is a maximum number of sectors between theinvalidated sectors and the neighboring data. This also has the furtheradvantage that the invalidation process is relatively simple because thesectors can be invalidated with one continuous laser action.

FIG. 4 shows an example of a track 5 which contains a first invalidatedkeylocker 7 i and a second invalidated keylocker 8 i. Also the furtherinformation area 9 o is not used anymore. Two new keylockers 7 and 8 arewritten on another location on the track 5. A new further informationarea 9 is also written, because that further information area 9 containspointers to the new keylockers. If the EKB and the BL need not to beupdated, these structures can be maintained in the old furtherinformation area 9 o. The new further information area 9 then containspointers to the EKB and BL.

FIG. 5 shows an example of a sector which is directly adjacent to asector that has been invalidated. The data in the sector depicted inFIG. 5 was not intended to be invalidated or damaged. Since the adjacentsector (not depicted in FIG. 5) was invalidated, however, the data inthe sector depicted in FIG. 5 was damaged by accident. The reason forthe damaging may be that the data is written interleaved and thatinvalidating of the keylocker invalidates also neighboring data. Thedata in the sector is depicted in a hexadecimal representation. The datawhich is accentuated with the black boxes is corrupted as a consequenceof the invalidation of the adjacent sector. This clearly shows thatinvalidation must not be done directly adjacent to data which must beleft intact.

Although the invention has been explained mainly with reference toembodiments of an optical recording device, similar embodiments ofrecording devices are suitable which have the characteristic thatinvalidation of data on the record carrier also damages data adjacent tothe invalidated data. Also, an optical disc may be used for the recordcarrier, or other media such as a magnetic disc or tape may be used. Itis noted that in this document the verb ‘comprise’ and its derived formsdo not exclude the presence of other elements or steps than thoselisted, and the word ‘a’ or ‘an’ preceding an element does not excludethe presence of a plurality of such elements, that any reference signsdo not limit the scope of the claims, that the invention may beimplemented by means of both hardware and software, and that several‘means’ may be represented by the same item of hardware. Further, thescope of the invention is not limited to the embodiments, and theinvention lies in each and every novel feature or combination offeatures described above.

1. Device for recording data on a track of a record carrier, whichrecord carrier comprises a first keylocker which holds information aboutthe data and a second keylocker which holds the same information, whichtwo keylockers are positioned adjacent to each other on the track, thedevice comprising invalidating means for invalidating the keylockers,characterized in that the invalidating means are able to invalidate thekeylockers by invalidating an identical part of the information of thefirst keylocker and of the second keylocker, the information of thefirst keylocker being arranged differently from the information of thesecond keylocker in that the information that is to be invalidated of atleast one keylocker is positioned closer to the other keylocker than ina situation in which the information of the keylockers is arrangedidentically.
 2. Device as claimed in claim 1, characterized in that theinformation about the data comprises information about the usage rightsof the data.
 3. Device as claimed in claim 1, characterized in that theinformation is divided into sectors, and that the information that is tobe invalidated consists of one or more sectors for each keylocker. 4.Device as claimed in claim 1, characterized in that the information thatis to be deleted of the first keylocker is directly adjacent to theinformation that is to be deleted of the second keylocker.
 5. Device asclaimed in claim 3, characterized in that the information that is to bedeleted is formed by the last two sectors of the first keylocker and thefirst two sectors of the second keylocker.
 6. Device as claimed in claim1, characterized in that the record carrier comprises more than twokeylockers which are adjacent to each other, and that the firstkeylocker and the second keylocker are the two outermost keylockers. 7.Record carrier having a track for recording data, the record carriercomprising a first keylocker which holds information about the data anda second keylocker which holds the same information, the two keylockersbeing positioned adjacent to each other on the track, characterized inthat the keylockers can be invalidated through invalidation of anidentical part of the information of the first keylocker and of thesecond keylocker, and the information of the first keylocker is arrangeddifferently from the information of the second keylocker in that theinformation that is to be invalidated of at least one keylocker ispositioned closer to the other keylocker than in a situation in whichthe information of the keylockers is arranged identically.
 8. Recordcarrier as claimed in claim 7, characterized in that the informationabout the data comprises information about the usage rights of the data.9. Record carrier as claimed in claim 7, characterized in that theinformation is divided into sectors, and that the information that is tobe invalidated consists of one or more sectors for each keylocker. 10.Record carrier as claimed in claim 7, characterized in that theinformation that is to be deleted of the first keylocker is directlyadjacent to the information that is to be deleted of the secondkeylocker.
 11. Record carrier as claimed in claim 9, characterized inthat the information that is to be deleted is formed by the last twosectors of the first keylocker and the first two sectors of the secondkeylocker.
 12. Record carrier as claimed in claim 7, characterized inthat the record carrier comprises more than two keylockers which areadjacent to each other, and that the first keylocker and the secondkeylocker are the two outermost keylockers.
 13. Method of recording dataon a track of a record carrier, which record carrier comprises a firstkeylocker which holds information about the data and a second keylockerwhich holds the same information, the two keylockers being positionedadjacent to each other on the track, the method comprising a step ofinvalidating the keylockers, characterized in that the step ofinvalidating the keylockers invalidates the keylockers by invalidatingan identical part of the information of the first keylocker and of thesecond keylocker, the information of the first keylocker being arrangeddifferently from the information of the second keylocker in that theinformation that is to be invalidated of at least one keylocker ispositioned closer to the other keylocker than in a situation in whichthe information of the keylockers is arranged identically.
 14. Method asclaimed in claim 13, characterized in that the information about thedata comprises information about the usage rights of the data. 15.Method as claimed in claim 13, characterized in that the information isdivided into sectors, and that the information that is to be invalidatedconsists of one or more sectors for each keylocker.
 16. Method asclaimed in claim 13, characterized in that the information that is to bedeleted of the first keylocker is directly adjacent to the informationthat is to be deleted of the second keylocker.
 17. Method as claimed inclaim 15, characterized in that the information that is to be deleted isformed by the last two sectors of the first keylocker and the first twosectors of the second keylocker.
 18. Method as claimed in claim 13,characterized in that the record carrier comprises more than twokeylockers which are adjacent to each other and that the first keylockerand the second keylocker are the two outermost keylockers.